mad-proxy CVE-2025-67485

Exploitation requires that mad-proxy (versions <= 0.3) be actively deployed in the traffic path as the HTTP/HTTPS detection-and-blocking enforcement point - the flaw is only meaningful where an organization relies on this proxy's interception rules for security. The limiting factors are substantial: the product is a niche Python tool, there is no direct host compromise (impact is confined to bypassing inspection and exposing traffic that should have been filtered), and there is no vendor fix, so mitigation depends on removing or supplementing the proxy. No authentication is required per the CVSS vector (PR:N), but the practical blast radius is bounded entirely by whether and where mad-proxy is used as a control.

This is a protection-mechanism-failure (CWE-693) bug in mad-proxy, a niche Python proxy, scored CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) - network vector, low complexity, no privileges or user interaction, with only low confidentiality impact and no integrity/availability impact. Real-world risk signals are consistently LOW and non-conflicting: EPSS is 0.24% (14th percentile), the CVE is NOT on CISA KEV, and no public exploit code was identified. No SSVC decision data was provided in the input. The important nuance is that this is a security-control bypass rather than a direct compromise: the vulnerability degrades mad-proxy's own detection/blocking function, so the 'victim' is the security posture of an environment that relies on mad-proxy to inspect traffic - exploitation exposes traffic that should have been intercepted rather than directly breaching a host. Combined with the obscurity of the product and the absence of any exploitation evidence, this is a genuinely low-priority issue for most organizations; it only matters where mad-proxy is actually deployed as an enforcement control. Note that there is currently NO vendor fix, so affected deployments cannot remediate by patching and must rely on compensating controls.

An attacker (or malicious insider traffic) crafts HTTP/HTTPS requests that fail to match mad-proxy's interception rules, so the traffic slips past the proxy's detection-and-blocking logic and reaches its destination uninspected, potentially exposing sensitive data that should have been filtered or logged. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is needed, but no public proof-of-concept exists and exploitation requires that mad-proxy actually be in the traffic path as a security control.